CVE-2022-3106

What it actually does

Missing validation of kmalloc() return value in ef100_update_stats allows a NULL pointer to be dereferenced when memory allocation fails, resulting in a kernel crash.

Why it matters to the business

Systems using affected network hardware may experience unexpected reboots or service outages triggered by routine statistics collection under memory pressure.

How an attack unfolds

A local attacker with low privileges triggers the ef100 NIC statistics path while the kernel is under memory pressure, causing the unchecked NULL allocation to be used and crashing the system.

How to fix it

Upgrade the Linux kernel to a version containing the missing NULL check; apply vendor backports for supported distributions; reboot after installation.

How to confirm the fix worked

Confirm the patched source no longer dereferences the kmalloc result without checking for NULL; run stress tests that force allocation failures while querying interface statistics.

Typical attack path

1. Obtain local user access on a Linux host with the SFC ef100 driver loaded
2. Exhaust kernel memory to force kmalloc failure
3. Invoke network interface statistics collection that reaches ef100_update_stats
4. Trigger NULL dereference leading to kernel panic

How to detect it

Review kernel logs for oops or panic entries referencing ef100_update_stats or ef100_nic.c; correlate with memory-pressure events and network interface activity.

What your security team should do

• Prioritize kernel updates on systems exposing the ef100 driver
• Monitor for availability alerts on affected hosts
• Test updated kernels in staging before broad deployment